In an effort to protect the privacy of patients and prevent identity theft, new technical controls will be in place within One Chart to protect patient and guarantor social security numbers. Beginning in June, most users will only see the last four digits of a patient’s social security number.
A select group, including those in Access Services and Health Information Management, will be able to view the full social security number.
“Each year, breaches involving access to and disclosure of full social security numbers occur,” said Deb Bishop, privacy officer, Nebraska Medicine and UNMC. “When that happens, we must report it to the State Attorney General, in addition to notifying the patient and the U.S. Department of Health and Human Services Office for Civil Rights.”
Bishop said last year 29 patients were notified their social security numbers were accessed for reasons that were not work related. A patient’s full social security number can also appear on a printed report and if it’s misplaced or misdirected, can result in a breach.
“Sometimes, we have to offer credit monitoring services to affected patients,” Bishop said. “This can increase the cost of a breach substantially and of course, negatively impact the patient as well as the reputation of Nebraska Medicine and UNMC.”
Bishop said there are few circumstances that require a full social security number and that colleagues have many other ways to identify the correct patient, including using the medical record number (MRN), date of birth and telephone number.
“There’s a belief that the more information we have, the better,” she said. “But the reality is privacy rules direct us to limit the amount of patient information we access and disclose to better protect patient privacy.”
By the end of June, most clinical colleagues will only see the last four digits of a patients’ social security number. Information Technology and the Privacy Office hope to have the project completed by the end of the year.
If you feel there is a strong need for full visibility of patients’ social security numbers for your work duties, you can request an exception to this policy. Exceptions will be based on whether there is a work-related need to know.
If we have to obtain it, how do we do so? We have to refer patients to dialysis centers and need their SSNs for admittance. Please advise.
Lisa,
Generally, the referral process involves communicating with the patient, so staff can request the full SSN from the patient.